PT-2016-5043 · Apache+3 · Apache Subversion+3

Publicado

2016-04-29

·

Atualizado

2024-06-15

·

CVE-2016-2167

CVSS v3.1

6.8

Média

VetorAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Apache Subversion versions prior to 1.8.16 Apache Subversion versions 1.9.x prior to 1.9.4
Description The issue allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string. This is due to a problem in the canonicalize username function when Cyrus SASL authentication is used.
Recommendations For versions prior to 1.8.16, update to version 1.8.16 or later. For versions 1.9.x prior to 1.9.4, update to version 1.9.4 or later.

Correção

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2020-1641
ALT-PU-2020-2914
CVE-2016-2167
DLA-448-1
DSA-3561-1
MGASA-2016-0161
OPENSUSE-SU-2024:10538-1
SUSE-SU-2016:1249-1
SUSE-SU-2016:1511-1
SUSE-SU-2016_1249-1
SUSE-SU-2017:2200-1
USN-3388-1
USN-3388-2

Produtos afetados

Alt Linux
Apache Subversion
Suse
Ubuntu